[Snort-sigs] Excluding the snort host from all rules?

Matthew Watchinski mwatchinski at ...435...
Thu Jul 22 07:18:14 EDT 2004


Have you set your HOME_NET and EXTERNAL_NET variables yet in the 
snort.conf file?  If not you should set those to the correct network 
ranges, it will most likely fix your noise problem.

Cheers,
-matt


R S wrote:

> Hello,
>  
> Is there a way to exclude the snort host from all rules?  I am a very 
> new user and have just installed the software.  Almost all the alerts 
> I see are my Snort machine talking to our Windows 2000 server.  I get 
> messages for L3retriever, SMB, etc. and they are mostly from my snort box.
>  
> How can I tell snort to ignore everything coming from itself???
>  
> Thanks,
>  
> R
>
> ------------------------------------------------------------------------
> Do you Yahoo!?
> New and Improved Yahoo! Mail 
> <http://us.rd.yahoo.com/mail_us/taglines/100/*http://promotions.yahoo.com/new_mail/static/efficiency.html> 
> - 100MB free storage! 






More information about the Snort-sigs mailing list